Filter player payout types by admin-enabled methods

cashout_method_types list now JOINs admin_payout_settings so the
player's profile payout dropdown only shows types the admin can
actually process.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

api/cashout_method_types.php

@@ -9,9 +9,15 @@ $isAdmin = isLoggedIn() && !empty($_SESSION['is_admin']);
 
 switch ($action) {
 
-    // Public: active types for player dropdown
+    // Public: active types that admin has enabled for payout processing
     case 'list':
-        $rows = db()->query("SELECT slug,label,icon,description FROM cashout_method_types WHERE is_active=1 ORDER BY sort_order ASC, id ASC")->fetchAll();
+        $rows = db()->query("
+            SELECT cmt.slug, cmt.label, cmt.icon, cmt.description
+            FROM cashout_method_types cmt
+            INNER JOIN admin_payout_settings aps ON aps.method_key = cmt.slug
+            WHERE cmt.is_active = 1 AND aps.is_enabled = 1
+            ORDER BY cmt.sort_order ASC, cmt.id ASC
+        ")->fetchAll();
         echo json_encode(['success'=>true, 'types'=>$rows]);
         break;